@optimuslabs/harness-map-staging 1.5.16

package/README.md

@@ -0,0 +1,46 @@
+## log-llm-config (`@optimuslabs/harness-map-staging`)
+
+CLI helpers for Optimus Security startup workflows.
+
+### Prerequisites
+
+- Node.js 18+
+- `OPTIMUS_ENDPOINT` defined in `optimus.env` (e.g. `http://localhost:8080/endpoint_security/`)
+
+### Commands
+
+#### `log_uuid`
+
+Collects the machine hardware UUID (or uses the `OPTIMUS_HARDWARE_UUID` env variable), prints it, and POSTs a startup payload to `OPTIMUS_ENDPOINT/startup/`. If the server responds with a key, it stores it at `~/.optimuslabs/management/auth_key.txt`.
+
+```bash
+OPTIMUS_ENDPOINT=http://localhost:8080/endpoint_security/ \
+npx --yes --package=@optimuslabs/harness-map-staging@latest log_uuid-staging
+```
+
+- **Optional flags** (for git context, similar to `optimus-init`):
+  - `--uuid <hw_uuid>` – override hardware UUID
+  - `--user <git_user>` – e.g. `$(git config user.name)`
+  - `--repo <git_remote>` – e.g. `$(git remote -v)`
+  - `--branch <git_branch>` – e.g. `$(git branch --show-current)`
+  - `--agent <agent_name>` – e.g. `Cursor`
+
+#### `log-llm-config`
+
+Legacy helper that logs local Optimus/Cursor configuration files to `configs.txt`.
+
+You can also pass the UUID explicitly:
+
+```bash
+npx --yes --package=@optimuslabs/harness-map-staging@latest log_uuid-staging --uuid "DUMMY-LOCAL-UUID"
+```
+
+### Development
+
+```bash
+npm install
+npm run build
+```
+
+> Proprietary package. Do not publish to public registries.
+

package/dist/apply_deferred_vscdb.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+// Runs after Cursor SIGKILL: applies queued state.vscdb patches, then immediately runs
+// post-restart verification so the server gets `verified` without waiting for the next prompt.
+import { applyDeferredVscdbFromDisk } from './log_config_files/runtime/remediation_sync.js';
+import { runPostApplyVerification } from './log_config_files/runtime/compliance_check.js';
+import { hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { finalizeAndUploadComplianceSessionLog, setActiveComplianceLogPath, } from './log_config_files/runtime/compliance_session_log.js';
+const complianceLogPath = process.env.OPTIMUS_COMPLIANCE_LOG?.trim() || null;
+if (complianceLogPath) {
+    setActiveComplianceLogPath(complianceLogPath);
+}
+applyDeferredVscdbFromDisk()
+    .then(async (ok) => {
+    if (ok) {
+        try {
+            const outcomes = await runPostApplyVerification();
+            if (outcomes.length > 0) {
+                hookRunLog(`apply_deferred_vscdb: post_apply_verification count=${outcomes.length} ` +
+                    `verified=${outcomes.filter((o) => o.status === 'verified').length}`);
+            }
+            if (complianceLogPath) {
+                await finalizeAndUploadComplianceSessionLog(complianceLogPath);
+            }
+        }
+        catch (e) {
+            hookRunLog(`apply_deferred_vscdb: post_apply_verification error: ${e instanceof Error ? e.message : String(e)}`);
+            if (complianceLogPath) {
+                await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
+            }
+        }
+    }
+    else if (complianceLogPath) {
+        hookRunLog('apply_deferred_vscdb: apply failed');
+        await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
+    }
+    process.exit(ok ? 0 : 1);
+})
+    .catch(() => process.exit(1));

package/dist/bootstrap_constants.js

@@ -0,0 +1,15 @@
+/**
+ * Bootstrap-level path constants — known before the API response is available.
+ * Used by auth, hook logging, and audit output. Do not add agent-specific paths here.
+ */
+export const OPTIMUSLABS_MANAGEMENT_REL = '.optimuslabs/management';
+/**
+ * All hook-written log files live under this subdirectory, grouped by type
+ * (see LOG_GROUP_* below). Keeping logs in one subtree leaves the management
+ * root limited to secrets/identity/state (auth_key, organization-uuid, contracts).
+ */
+export const OPTIMUSLABS_LOGS_REL = `${OPTIMUSLABS_MANAGEMENT_REL}/logs`;
+/** Log group subdirectories under {@link OPTIMUSLABS_LOGS_REL}. */
+export const LOG_GROUP_HOOK = 'hook';
+export const LOG_GROUP_COMPLIANCE = 'compliance';
+export const LOG_GROUP_AUDIT = 'audit';

package/dist/cli/bash_script_generator.js

@@ -0,0 +1,95 @@
+import { readFileCollectionVscdbContract } from '../log_config_files/runtime/management_storage.js';
+/** Reactive ItemTable key from backend-derived cache (written on log-config); same path as remediations. */
+function readReactiveStorageItemKeyFromDisk() {
+    const k = readFileCollectionVscdbContract()?.reactive_storage_item_key;
+    return typeof k === 'string' && k.trim() !== '' ? k.trim() : null;
+}
+const fileCategories = [
+    { label: 'Cursor: mcp.json', targets: ['./.cursor/mcp.json', '$HOME/.cursor/mcp.json'] },
+    { label: 'Claude: .mcp.json', targets: ['./mcp.json', './.mcp.json', '/Library/Application Support/ClaudeCode/managed-mcp.json'] },
+    { label: 'Claude: settings.json', targets: ['./.claude/settings.json', './.claude/settings.local.json', '$HOME/.claude/settings.json', '/Library/Application Support/ClaudeCode/managed-settings.json'] },
+    { label: 'Cursor: hooks.json', targets: ['./.cursor/hooks.json', '$HOME/.cursor/hooks.json', '/Library/Application Support/Cursor/hooks.json'] },
+    { label: 'Cursor: User/settings.json (user-level)', targets: ['$HOME/Library/Application Support/Cursor/User/settings.json'] },
+];
+function buildSqliteCategories() {
+    const key = readReactiveStorageItemKeyFromDisk();
+    if (!key)
+        return [];
+    return [
+        {
+            label: 'Cursor: state.vscdb (reactive blob / composerState)',
+            dbPath: '$HOME/Library/Application Support/Cursor/User/globalStorage/state.vscdb',
+            table: 'ItemTable',
+            key,
+            jsonPaths: [['composerState'], []],
+        },
+    ];
+}
+function buildFileCategoryLines(category) {
+    return [
+        `echo "===== ${category.label} ====="`,
+        'files=(', ...category.targets.map((t) => `  "${t}"`), ')',
+        'expanded_files=()', 'paths=()', 'display_paths=()',
+        'for f in "${files[@]}"; do',
+        '  expanded=$(eval echo "$f")',
+        '  expanded_dir=$(dirname "$expanded")', '  expanded_base=$(basename "$expanded")',
+        '  abs_dir=$(cd "$expanded_dir" 2>/dev/null && pwd || echo "$expanded_dir")',
+        '  abs_path="$abs_dir/$expanded_base"', '  expanded_files+=("$abs_path")',
+        '  relative_path="$(to_relative "$abs_path")"', '  paths+=("$relative_path")', '  display_paths+=("$relative_path")',
+        'done', 'echo ""',
+        'if [ ${#paths[@]} -gt 0 ]; then', '  echo "Paths:"',
+        '  printf "%s\\n" "${paths[@]}" | awk \'!seen[$0]++\' | while IFS= read -r dir; do', '    echo "$dir"', '  done',
+        '  echo ""', 'else', '  echo "Paths: (none)"', 'fi', 'echo ""',
+        'for idx in "${!expanded_files[@]}"; do', '  expanded="${expanded_files[$idx]}"', '  display="${display_paths[$idx]}"',
+        '  if [ -f "$expanded" ]; then',
+        `    echo "===== ${category.label}: $display ====="`, '    cat "$expanded"',
+        '  else', `    echo "===== ${category.label}: missing: $display ====="`, '  fi',
+        'done', 'echo ""',
+    ];
+}
+function buildSqliteCategoryLines(category) {
+    const jsonPathsLiteral = JSON.stringify(category.jsonPaths);
+    const safeSqlKey = category.key.replace(/'/g, "''");
+    return [
+        `echo "===== ${category.label} ====="`, `db_path="${category.dbPath}"`,
+        'expanded=$(eval echo "$db_path")',
+        'if [ -f "$expanded" ]; then', '  if command -v sqlite3 >/dev/null 2>&1; then',
+        '    echo "===== $expanded ====="',
+        `    query_result=$(sqlite3 "$expanded" "SELECT value FROM ${category.table} WHERE key='${safeSqlKey}'")`,
+        '    if [ -n "$query_result" ]; then',
+        `      echo "===== key: ${category.key} ====="`,
+        `      LOG_CONFIG_JSON_VALUE="$query_result" python3 - <<'PY'`,
+        'import json', 'import os', '',
+        'raw = os.environ.get("LOG_CONFIG_JSON_VALUE", "")',
+        'if not raw:', '    print("{}")', '    raise SystemExit',
+        `paths = ${jsonPathsLiteral}`,
+        'try:', '    data = json.loads(raw)',
+        'except json.JSONDecodeError as exc:', '    print(f"failed to parse JSON: {exc}")', '    raise SystemExit',
+        'def walk(obj, path):', '    cur = obj',
+        '    for segment in path:', '        if isinstance(cur, dict):', '            cur = cur.get(segment)', '        else:', '            return None',
+        '    return cur',
+        'selected_value = None', 'selected_label = None',
+        'for path in paths:', '    value = walk(data, path)',
+        '    if value is not None:', '        selected_value = value', '        selected_label = ".".join(path) if path else "root"', '        break',
+        'if selected_value is None:', '    print("{}")',
+        'else:', '    print(f"[path: {selected_label}]")', '    print(json.dumps(selected_value, indent=2, sort_keys=True))',
+        'PY',
+        '    else', `      echo "===== key not found: ${category.key} ====="`, '    fi',
+        '  else', '    echo "===== sqlite3 not found; skipping ====="', '  fi',
+        'else', '    echo "===== missing: $expanded ====="', 'fi', 'echo ""',
+    ];
+}
+function renderBashScript() {
+    const scriptLines = [
+        '#!/usr/bin/env bash', 'set -euo pipefail',
+        'output_file="$(pwd)/configs.txt"', ': > "$output_file"', 'exec >"$output_file"', 'exec 2>&1', '',
+        'repo_root="$(pwd)"',
+        'to_relative() {', '  local path="$1"', '  if [[ "$path" == "$repo_root"* ]]; then',
+        '    local suffix="${path#"$repo_root"}"', '    if [ -z "$suffix" ]; then', '      echo "<project_root>"',
+        '    else', '      echo "<project_root>${suffix}"', '    fi', '  else', '    echo "$path"', '  fi', '}', '',
+        ...fileCategories.flatMap(buildFileCategoryLines),
+        ...buildSqliteCategories().flatMap(buildSqliteCategoryLines),
+    ];
+    return scriptLines.join('\n');
+}
+export { renderBashScript };

package/dist/cli.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+import { renderBashScript } from './cli/bash_script_generator.js';
+const args = process.argv.slice(2);
+const main = async () => {
+    if (args[0] === 'log_uuid') {
+        parseAndSetLogUuidEnvVars();
+        await import('./log_uuid/index.js');
+        return;
+    }
+    if (args[0] === 'log_config_files') {
+        const { main, logSingleFile } = await import('./log_config_files/index.js');
+        const filePathArg = args.find((arg, idx) => idx > 0 && !arg.startsWith('-') && (arg.includes('/') || arg.endsWith('.json') || arg.endsWith('.md')));
+        if (filePathArg) {
+            const success = await logSingleFile(filePathArg);
+            try {
+                process.exit(success ? 0 : 1);
+            }
+            catch {
+                // process.exit may be mocked in tests (throws instead of exiting); allow process to continue
+            }
+            return;
+        }
+        await main();
+        return;
+    }
+    if (args[0] === 'log_sensitive_paths_audit') {
+        const { main } = await import('./log_sensitive_paths_audit.js');
+        await main();
+        return;
+    }
+    if (args[0] === 'compliance_prompt_gate') {
+        const { runCompliancePromptGateCli } = await import('./compliance_prompt_gate.js');
+        await runCompliancePromptGateCli();
+        process.exit(0);
+        return;
+    }
+    if (args[0] === 'compliance_check_runner') {
+        await import('./compliance_check_runner.js');
+        return;
+    }
+    if (args[0] === 'dialog_prefs' ||
+        args[0] === 'is_suppressed' ||
+        args[0] === 'set_suppress' ||
+        args[0] === 'show') {
+        const { runDialogPrefsCli } = await import('./dialog_prefs_cli.js');
+        await runDialogPrefsCli();
+        process.exit(0);
+        return;
+    }
+    // `npx --package=@optimuslabs/harness-map-staging@latest <name>` runs this file (default bin) with args[0] set — not the named bin file.
+    if (args[0] === 'execute-trusted-restarts') {
+        const { runExecuteTrustedRestartsFromStdin } = await import('./execute_trusted_restarts.js');
+        try {
+            runExecuteTrustedRestartsFromStdin();
+        }
+        catch (e) {
+            console.error(e instanceof Error ? e.message : String(e));
+            process.exit(1);
+        }
+        process.exit(0);
+        return;
+    }
+    if (args[0] === 'apply-deferred-vscdb') {
+        await import('./apply_deferred_vscdb.js');
+        return;
+    }
+    // No command matched — output legacy bash script
+    console.log(renderBashScript());
+};
+function parseAndSetLogUuidEnvVars() {
+    let uuidArg;
+    let userArg;
+    let repoArg;
+    let branchArg;
+    let agentArg;
+    for (let i = 1; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--uuid' || arg === '-u') {
+            uuidArg = args[++i];
+            continue;
+        }
+        if (arg === '--user') {
+            userArg = args[++i];
+            continue;
+        }
+        if (arg === '--repo') {
+            repoArg = args[++i];
+            continue;
+        }
+        if (arg === '--branch') {
+            branchArg = args[++i];
+            continue;
+        }
+        if (arg === '--agent') {
+            agentArg = args[++i];
+            continue;
+        }
+        if (!arg.startsWith('-') && !uuidArg)
+            uuidArg = arg;
+    }
+    if (uuidArg)
+        process.env.OPTIMUS_HARDWARE_UUID = uuidArg;
+    if (userArg)
+        process.env.GITHUB_USER = userArg;
+    if (repoArg) {
+        process.env.OPTIMUS_WORKSPACE_REPO = repoArg;
+        process.env.GITHUB_REPOSITORY = repoArg;
+    }
+    if (branchArg)
+        process.env.GITHUB_REF_NAME = branchArg;
+    if (agentArg)
+        process.env.OPTIMUS_AGENT = agentArg;
+}
+/** Map each cli command to its functional unit for failure telemetry. */
+const COMMAND_UNIT = {
+    log_uuid: 'auth_version',
+    log_config_files: 'inventory',
+    log_sensitive_paths_audit: 'inventory',
+    compliance_prompt_gate: 'compliance',
+    compliance_check_runner: 'compliance',
+    'apply-deferred-vscdb': 'compliance',
+    'execute-trusted-restarts': 'compliance',
+    dialog_prefs: 'compliance',
+};
+main().catch(async (err) => {
+    // Top-level safety net: any uncaught error in a cli command is reported as a failed
+    // FunctionalRun (awaited so the POST lands before exit), then surfaced + non-zero exit.
+    try {
+        const cmd = args[0] || '';
+        const unit = COMMAND_UNIT[cmd] || 'inventory';
+        const { reportFunctionalFailureAwait } = await import('./log_config_files/runtime/client_event_reporter.js');
+        await reportFunctionalFailureAwait(unit, cmd, err);
+    }
+    catch {
+        /* never let telemetry mask the original error */
+    }
+    console.error(err instanceof Error ? err.stack || err.message : String(err));
+    try {
+        process.exit(1);
+    }
+    catch {
+        /* process.exit may be mocked in tests */
+    }
+});

package/dist/cli_invocation_match.js

@@ -0,0 +1,30 @@
+import { basename } from 'node:path';
+import { fileURLToPath } from 'node:url';
+function toFsPath(scriptPathOrFileUrl) {
+    if (scriptPathOrFileUrl.startsWith('file://')) {
+        return fileURLToPath(scriptPathOrFileUrl);
+    }
+    return scriptPathOrFileUrl;
+}
+/**
+ * Basename of the invoked script, normalized so npm `bin` names (hyphens) match compiled
+ * artifacts (underscores), e.g. `execute-trusted-restarts` → `execute_trusted_restarts`.
+ */
+export function normalizedCliScriptBasename(scriptPathOrFileUrl) {
+    return basename(toFsPath(scriptPathOrFileUrl))
+        .replace(/\.[cm]?js$/, '')
+        .replace(/-/g, '_');
+}
+/**
+ * True when this process was started as the given module's CLI entrypoint.
+ * Handles npx bin shims (symlink paths) and hyphen vs underscore bin/file naming.
+ */
+export function isThisCliModule(argv1, thisImportMetaUrl) {
+    if (!argv1)
+        return false;
+    const entry = normalizedCliScriptBasename(argv1);
+    const self = normalizedCliScriptBasename(thisImportMetaUrl);
+    if (entry === '' || self === '')
+        return false;
+    return entry === self || entry === `${self}_staging`;
+}

package/dist/compliance_check_runner.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+import { complianceRunnerRunnerLine, hookLogAppendSection } from './log_config_files/runtime/hook_logger.js';
+import { normalizeAgentToken, runComplianceCheck, } from './log_config_files/runtime/compliance_check.js';
+import { finalizeAndUploadComplianceSessionLog, initComplianceSessionForRunner, isFinalizeComplianceSessionArgv, isInflightComplianceLogPath, parseComplianceLogArg, resolveComplianceSessionLogPath, } from './log_config_files/runtime/compliance_session_log.js';
+import { existsSync } from 'node:fs';
+import { getStoryId, flushBufferedClientEvents, reportFunctionalRun, reportFunctionalFailureAwait, } from './log_config_files/runtime/client_event_reporter.js';
+function parseAgentArg() {
+    const eq = process.argv.find((a) => a.startsWith('--agent='));
+    if (!eq)
+        return undefined;
+    const normalized = normalizeAgentToken(eq.slice('--agent='.length));
+    return normalized ? normalized : undefined;
+}
+(async () => {
+    let complianceLogPath = parseComplianceLogArg(process.argv);
+    if (isFinalizeComplianceSessionArgv(process.argv)) {
+        if (complianceLogPath) {
+            await finalizeAndUploadComplianceSessionLog(complianceLogPath);
+        }
+        process.exit(0);
+    }
+    if (complianceLogPath) {
+        const resolved = resolveComplianceSessionLogPath(complianceLogPath);
+        if (existsSync(resolved) && isInflightComplianceLogPath(resolved)) {
+            complianceLogPath = initComplianceSessionForRunner(resolved);
+        }
+        else {
+            complianceLogPath = null;
+        }
+    }
+    else {
+        hookLogAppendSection('compliance_check_runner (background sync + check)');
+    }
+    complianceRunnerRunnerLine('compliance_check_runner: start');
+    // Background runner: opportunistically flush any telemetry the (non-blocking) gate buffered.
+    getStoryId();
+    await flushBufferedClientEvents();
+    try {
+        await runComplianceCheck(parseAgentArg());
+        complianceRunnerRunnerLine('compliance_check_runner: finished ok');
+        await reportFunctionalRun({ unit: 'compliance', command: 'compliance_check_runner', outcome: 'ok' });
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.stack ?? err.message : String(err);
+        complianceRunnerRunnerLine(`compliance_check_runner: uncaught error — ${err instanceof Error ? err.message : String(err)}`);
+        complianceRunnerRunnerLine(`compliance_check_runner: stack_or_detail ${detail.slice(0, 4000)}`);
+        process.stderr.write(`compliance_check_runner error: ${err instanceof Error ? err.message : String(err)}\n`);
+        if (complianceLogPath) {
+            await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
+        }
+        await reportFunctionalFailureAwait('compliance', 'compliance_check_runner', err);
+        process.exit(1);
+    }
+    if (complianceLogPath) {
+        await finalizeAndUploadComplianceSessionLog(complianceLogPath);
+    }
+})();